CVE-2014-8799 Scanner
Detects 'Directory Traversal' vulnerability in DukaPress plugin for Wordpress affects v. before 2.5.4.
Short Info
Level
Medium
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
1 month 2 days
Scan only one
URL
Toolbox
-
The DukaPress plugin is an e-commerce solution for WordPress that enables users to easily sell products and services on their websites. With DukaPress, users can create product pages, manage orders, and process payments seamlessly. However, a vulnerability in version 2.5.4 and below of DukaPress has been discovered that can compromise the security of websites using this plugin.
The vulnerability, with the code CVE-2014-8799, is a directory traversal bug found in the dp_img_resize function in php/dp-functions.php. This bug allows attackers to read arbitrary files through a ".." in the 'src' parameter to lib/dp_image.php. In other words, this vulnerability enables attackers to access sensitive files and data on the targeted website.
When exploited, this vulnerability can result in attackers gaining access to sensitive files such as password files, configuration files, and other sensitive data that can lead to a complete website takeover. This vulnerability can also lead to unauthorized access to customer information, which can result in a data breach.
In conclusion, it is essential to stay informed about vulnerabilities in digital assets, such as websites. With the pro features of the s4e.io platform, it is easy to quickly learn about vulnerabilities and take action to protect your online assets. Stay vigilant and take proactive measures to protect your website from malicious attacks.
REFERENCES
